Demystifying the 3 key Stakeholders roles & responsibilities in GDPR

GDPR 2018 (General Data Protection Regulation) finally came into existence on the 25th May, 2018. GDPR & DPA (Data Protection Act) has become the most talked about discussion in the last few months, while GDPR superseded the DPA in the European union. The rest of the world still struggles to catch up with the pace.

The understanding is critical. EU data protection law only applies to “personal data”. Information that does not fall within the definition of "personal data" is not subject to EU data protection law. GDPR is critical for every Organisation that processes, collects, transmits and archives personal data that belongs to EU residents regardless of which country the business is located. Thus, the regulation applies even to organizations within India and other countries whose goal is processing any personal data of EU residents for whatsoever reason.

Understanding the key stakeholders and set rules in GDPR.

The Controller: The term "controller" is of prime importance since compliance obligations under EU data protection law are imposed on controllers. You may have joint controllers to share responsibilities considering the scale of business but the net regulations for the controllers do not change.

Rules for the Controller:

* The controller must adequately record multiple details regarding the transaction, including identity of the subject whose data is undergoing collection.

* Duration of storage.

* When an individual's personal information is subject to processing, the controller informs the subject and obtains consent when necessary.

The Processors: Processor are any entity, organization, or firm on a local, regional, or federal level that processes, collects, transmits, or archives personal data under the controller's instructions, both within and outside the EU. Processors also have direct compliance obligations under the GDPR. A lot of countries like India provide services and are hence directly compelled to fulfill GDPR compliance obligations. The controller initiates this engagement via a written agreement that binds the processor to the necessary obligations.

Rules for the Processor:

* Operate inline with documented instructions from the controller

* Enforce confidentiality agreement with individuals who manage processing of personal data and guarantee the security of personal data.

* Comply with the rules pertaining and implement necessary policies and processes that facilitate the controller's compliance with privacy rights of data subjects.

* Help the controller acquire approval from Data Protection Officers (DPOs).

* Return or delete personal data upon termination of the engagement.

* Furnish all information that demonstrates GDPR compliance.

* Maintain all accurate records of processing’s, that controller is mandated to keep. This includes details that identify the controller, processor, representatives, or DPOs.

* Capture various types of processing activities conducted at the behest of the controller are also to be recorded along with Cross-Border Data Transfers and the security protocol established to protect processed data.

Data protection officer (DPO): DPOs must be appointed in the case of public authorities, organizations that engage in large scale systematic monitoring and organizations that engage in large scale processing of sensitive personal data. If your organization doesn’t fall into one of these categories, then you do not need to appoint a DPO. This role is typically the enterprise security leadership role required by the General Data Protection Regulation (GDPR) who in turn will be responsible for overseeing data protection strategy and implementation to ensure compliance with GDPR requirements.

Rules for the Data Protection Officer:

* Educating and training the company employees on important compliance requirements.

* Specialized training and agreement to guarantee security of personal data with staff involved in data processing.

* Conduct audits to ensure compliance and address potential issues proactively.

* Be the point of contact between the company and GDPR Supervisory Authorities.

* Monitor performance with necessary guidance on data protection efforts.

* Maintain comprehensive records of all data processing activities conducted by the company, including the purpose of all processing activities, which must be made public on request.

* Interfacing with data owners to inform them about how their data is being used, their rights to have their personal data erased, and share updates on what measures the company has put in place to protect their personal information.

The data protection officer performs his or her tasks with due regard to the risk associated with processing operations, considering the nature, scope, context and purposes of processing.

GDPR Governance Service from Crayon is a comprehensive GDPR management and risk mitigation solution. Aligning to the required policies & process frameworks for GDPR can save organisations from potential risks. Failure to prepare for the regulation could have serious consequences, not only to your bottom line, but also to your customer relationships and brand image.

Rajesh Thadhani
Director - Crayon Software Experts P. Ltd